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Abstract 

In this Comment we question the security of recently proposed by Degiovanni et al. 
[Phys. Rev. A 69 (2004) 032310] scheme of quantum dense key distribution. 

PACS number(s): 03.67.Hk, 03.65.Ud 

I. INTRODUCTION 

Recently Degiovanni et al. [1] have proposed (and experimentally implemented) a new 
protocol of quantum key distribution. As it embeds the advantages of both quantum key 
distribution scheme and quantum dense coding scheme, the new protocol has been called 
quantum dense key distribution (QDKD). The novelty of QDKD lies in the fact that it enables 
legitimate users (Alice and Bob) to exchange two bits - one generated by Alice (j) and 
second generated by Bob (k) during a single round of the protocol, i.e. with the use of a 
single qubit traveling from Alice to Bob and backward. In this way the efficiency (if properly 
defined) of the protocol could surpass that of e.g. BB84 protocol [2]. The authors analyze the 
effect of the quantum channel losses and conclude that QDKD is more efficient than BB84 for 
the quantum transmission probability P>1\% . QDKD has been claimed to be secure against 



all individual attacks. The security condition proposed has the form of an inequality (Eq. (6) 
of [1]) involving two parameters - quantum bit error rate Q and probability of correlated 

results P^g^ . The security proof states that fulfillment of this inequality ensures that mutual 

information between an eavesdropper (Eve) and legitimate users is less than that between 
Alice and Bob. In this Comment we question this statement. We present two simple schemes 
which enables Eve to acquire mutual information exceeding that of Alice and Bob while still 
fulfilling the above mentioned inequality. 

This Comment is organized in the following way. In order to present notation we 
summarize the QDKD in Sec. II. In Sec. Ill we present simple counterexample to Eq. (4) of 
[1]. Sees. IV and V contain our main result i.e. the eavesdropping protocols which show that 
the security condition given by Eq. (6) of [1] is not sufficient to ensure security of the QDKD 
protocol. We present an attack on the Alice and Bob key in Sec. IV and V respectively. 



II. QUANTUM DENSE KEY DISTRIBUTION 

In this section we summarize the QDKD protocol originally proposed in [1]. Each 
round of this protocol consists of the following steps: 

1. Alice prepares two qubits in modes A and B in a singlet state ^^^b)^ where 
\^ab) = ^^a)\^b)-\^a)\^b))/'-^ ■ (Jj^ the experimental implementation of Degiovanni et al. [1] 
\^k)(\^k)) stands for a horizontally (vertically) polarized single photon in a given spatial 
mode K). 

2. Alice encodes the value of her key j by performing operation where 
^B=\^B \~\^b sends the qubit B to Bob. 
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3. Bob randomly switches between two modes, namely the message mode (MM) and the 
control mode (CM). 

^MM jyjjyj encodes the value of his key k by performing operation Z* and sends the 
qubit B back to AUce. 

^MM p^YicQ performs measurement which discriminates between the orthogonal states ^ab) 
and announces publicly its result m (m = stands for ^^b)' whereas m = lstands for 

gMM j^Yice and Bob calculate the value of their partner's key according to 

k^^^=m@ j 

(1) 

=m®k, 

where A:*'*' is the value of Bob's key as seen by Alice and is the value of Alice's key 
seen by Bob. 

4™. In CM Alice and Bob perform local measurements (projectors on the base |o), l)}) 
which, together with the use of classical communication, allows an estimation of the mean 
value of the parity operator R = 00^ )(00^ + ^ ^ab )(l 1 ab • 

After many rounds of the protocol Alice and Bob estimate quantum bit error rates 

Q''^ = prob(j ^ r^) 

(2) 

and the probability of correlated results P^^^ = (/?) . Of course in the case of noiseless channel 
and without eavesdropping P^^^^=0 and m = j®k. It follows that = j, k^^^=k and 
q(a) ^ q(b) = . On the other hand, if the values of Q^^^ , Q^""^ or are nonzero then 
Alice and Bob use these parameters to estimate maximal information available to Eve. The 
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main result of the security proof given in Section III of [1] states that the following inequality 
(given with the use of Shannon binary entropy H(x) ) 



HiQ) + HiP^^J<l, (3) 

ensures that mutual information between legitimate users is greater then between any of them 
and the eavesdropper i.e. 

r(A) ^ r(A) 
^ AB ^ AE 

r(A) ^ r(A) 

J(B) ^ 7(B) ■ ^ ' 

^ AB ^ AE 

J-(B) V. t(B) 
^ AB ^BE 



I'^Y Stands for mutual information on key Z between users X and Y 



III. SIMPLE SCHEME WITH NO CORRELATION INDUCED 

With the general strategy of eavesdropping given by operators Jg^ and Kg^ acting on 
mode B and some auxiliary system E in state \e^) (see Fig. 1 of [1]) the probability of 
correlated results is given by Pcorr ip where = ® ^£X^£ with 

Pab -\^ab){^abW\^ab){^ab (Here and below we assume that both keys are symmetric 



i.e. and 1 is generated with the same probability.) Degiovanni et al. present the following 
formula (Eq. 4 in [1]) for the probability of correlated results 

Pcorr=lk + {l^"ABE\^~ABE)l (5) 

where 



M' ABE ) ~ ^BE^B'^BE \ ^AB /®\^E 
^ ABE / ~ ^BE^B'^BE ^AB )®\^E 



(6) 
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Below we will show that Eq. (5) is not generally valid. Let us take as an auxiliary system E 
single mode and let this mode not contain any photons. Such a state will be denoted by 

e^) = vflCg) . Let both operators J^^ and K^^ be the SWAP operators 

JsE = KsE=SWAP,,. (7) 
Obviously with such an "eavesdropping" scheme Bob detects no photons and consequently 
P^„„ = . On the other hand. 







m+ ^ 


)® 


^^abe) 




^AB 1 


® 



(8) 

and from Eq. (5) one obtains P^^^^ =1/2 0. Of course, our scheme is not an eavesdropping 

one as it does not provide any information to Eve. In the next section we show, however, that 
it can be easily modified to be an effective eavesdropping tool. 

IV. ATTACK ON ALICE'S KEY 

The proposed eavesdropping strategy consists of two modes - the eavesdropping 
mode and error tuning mode. Each photon traveling form Alice to Bob and backward is 
attacked by one of these two modes at random The eavesdropping mode is taken with a 
probability piO< p<l ) and the error tuning mode with a probability {l- p). 

Error tuning mode. In this mode (see Fig. la) Eve does not obtain any information 
about the key. However, it enables her to control quantum bit error rates Q^^^ and 2*^^ and 
thus to control mutual information between Alice and Bob. There is no need for any auxiliary 
system in this mode. The unitary operator J^^ = 1^ is just identity on mode B , whereas K^^ 



is given by Kg^ = Z^. q takes the value of zero with a probability 



1 



+ E and the value of 

v2 J 
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one with a probability — 8 . Parameter e is bounded by 0<E<l/2. Obviously the 

v2 J 

probabiHty of the correlated results vanishes i.e. P^^^ =0. The value of the Alice's final 
measurement in this mode is given by m = j ®k® q . It follows form Eq. (1) that 
k^^^ =k®q and / ^^ = j®q. Thus quantum bit error rates are 

Q^'^=Q^'^ = \-^. (9) 

Eavesdropping mode. In this mode an auxiliary system E is needed (see Fig. lb). Let it be 
again be a single, empty mode ( kg) = vac^)). The unitaries are defined as 



(10) 



J,, = SWAP,, 
K,,=ZISWAP,, 



Now q takes both values (zero and one) with the same probability 1/2 . The probabiHty of the 
correlated results vanishes again {P^^^^ =0). The value of the Alice's final measurement does 

not depend on k and is given by m = j®q. Thus k^^^ =q, f^' = j®q®k and the 
quantum bit error rates are 

Q''> = Q"> = \, (11) 

which means that there is no information flow between Alice and Bob in this mode. On the 
other hand Eve can correctly calculate the value of Alice' s key with the use of the equation 
f^'=m®q. Thus, Eve has a perfect knowledge of Alice's key during the eavesdropping 
mode and knows nothing about Alice's key during the error tuning mode. It follows that 
mutual information between Eve and Alice is given by 

I'A' = P- (12) 
From Eqs. (9) and (1 1) the total quantum bit error rates can be calculated as 
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Q^'^ = Q^'^ = \-^, (13) 
where x = z{i- p). It leads to the following formula for mutual information between Alice 

X \. With the assumed bounds on p and e (0</?<l and 



and Bob I^^ = I^^ = \-H 
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0<8<l/2) parameter x can take arbitrary value within the range < x < 1/2 . This ensures 
that mutual information is nonzero i.e. 

/i^)>0. (14) 
For a given p Eve can choose the parameter £ to allow any value of within the range 
Q<I^^ <\-H{p/2). Let us now analyze the security condition given in [1]. Clearly 
H{q)+H{P^^^^) = \-I^^ , which due to Eq. (14) always fulfills the required inequality 
H{Q)+H{P^J<\. 

It should be noticed that our eavesdropping scheme induces losses which can be 
observed by Bob during the control mode. Let us denote by P the probability that a photon is 
successfully transmitted from Alice to Bob in the case of no eavesdropping. The transmission 
probability as observed by Bob - /^^^ is suppressed due to Eve's action and takes the value 

Pobs - p)- Thus, the parameter P^^^ could be used as an eavesdropping witness. Let us 
emphasize, however, that the security proof based on transmission probability cannot be 
based on fundamental principles, which is usually expected in the field of quantum 
cryptography. This is because one cannot be sure that Eve does not replace the original 
quantum channel by a better one with the transmission probability P' (P'> P). In this way 

Eve can hide induced losses provided that she chooses the value of p< p,^ , where 
Pmax - {P'~P)l P' ■ Thus eavesdropping can be safely performed in the realistic case P <\. 
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V. ATTACK ON BOB'S KEY 



This attack also consists of error tuning mode and eavesdropping mode (taken with 
probability (1 - p) and p respectively. The error tuning mode is the same as the one presented 
in Sec. IV. In the eavesdropping mode (see Fig. Ic) Eve uses an auxiliary system E , which is 
a single mode again, however, now it contains a single horizontally polarized photon i.e. 
\^e) = \^e)- Eve starts with measuring the qubit in the mode B in the base |o), l)}. Let us 
denote the result of this measurement by t . Note that after the measurement mode B contains 
no photons. Next two operations, first Vg^ and then X'^, are performed on state 

^be) = \^'^'^b)\^e) • Unitary operation Vg^ can be easily implemented with the use of a half- 
wave plate and a polarizing beam splitter (see Fig. 2). Vg^ performs the following 
transformation, when acting on relevant states, (5 = 0, 1 ) 

Vbe |vflCg)|5£) = -^jOg)|vac£)+(-iy \vaCs)\lE)]. (15) 

The operation X is just the polarization NOT gate (X = 0)(l + l)(0 ). It is performed 
conditionally when the measured photon appears vertically polarized (t = l). Thus, after 
performing operation X'^V the state of the modes B and E is 

\X^) = X',v\^l^^) = ^i\t,)\vac,) + \vac,%)) . (16) 

The above equation explains why the probability of correlated results again vanishes 
(^corr-^)- During the control mode measurement Bob has equal chances of finding no 
photon in mode B or finding a photon in the appropriate polarization state \ t) . In the message 

mode the state \ ^be ) is transformed by Bob into 
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^il') = 2^ |^^;^) = 7^((-irk.)|vac,) + |vac,)|l,)) . (17) 
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Eve transforms the above state with the use of operation into ^be) • It follows from 

Eq. (15) that 

|^fi> = (-ir|vac,)|(/c4). (18) 
Thus the result of the measurement performed by Eve on mode E is given by n = kt. Finally 
Eve sends a photon in the state \tj^) back to Alice. Alice state is now given by 

|(i-0.)k.)=4|n)-(-i)'|^;.))- (19) 



So Alice's measurement generates results m randomly, independently of j and k . Quantum 
bit error rates during eavesdropping mode are thus equal to 1/2 . It means that analysis of the 
mutual information between Alice and Bob presented in the previous Section applies to the 
present case as well. Let us now consider the mutual information between Eve and Bob. In the 
case of t = the result of Eve measurement n = (which is obviously independent of k ). 
However, in the case of t = l the result of this measurement n = k gives her perfect 
knowledge about the key. Both cases are equally probably so the considered mutual 
information is given by 

41' =f (20) 

Let us recall here that for a given p Eve can arbitrarily tune I^^J within the range 
0</S <l-J^(/'/2). Once again Eve gets the advantage 4^ >/S, while fulfilling the 
security condition H{q)+H {P^^^ ) = l-lfj<l. 

Let us also consider the losses induced by an attack on Bob's key. The observed 
transmission probability is given by P^^^ = P{l- p)+ p/2. Thus P^i,^ >P if < 1/2 . In this 
case there is not only no need for quantum channel improvement but even an appropriate 



fraction of photons has to be filtered off. In the opposite case P>l/2 Eve can hide induced 
losses if she uses a quantum channel of transmission probability P'> P and takes p < , 
where p^ ={P'-P)/{P'-l/2). 



VI CONCLUSIONS 



We have presented two eavesdropping schemes which impair the security of the 
recently proposed QDKD protocol. Let us emphasize that none of them requires the so-called 
unlimited computing power. In contrary, both schemes can be easily implemented with the use 
of current technology. If Eve can perform polarization CNOT gate (which is still beyond 
today's technology) she can use the scheme previously proposed by us [3] in the context of 
ping-pong protocol [4] to improve her attack on Bob's key. With this scheme, the quantum 
bit error rate generated by eavesdropping can be reduced from 1/2 to 1/4. Let us finally 
emphasize that we do not criticize the general idea of combining quantum key distribution 
with quantum dense coding. Note that this idea has been recently successfully exploited by 
Cai and Li [5] in their quantum cryptographic protocol. What we wish to show in this 
Comment is that the condition given in Eq. (6) of [1] does not ensure secure transmission of 
the keys. 
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Fig. 1 Eavesdropping schemes: (a) error tuning mode, (b) eavesdropping mode (attack on 
Alice key), (c) eavesdropping mode (attack on Bob key). 
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Fig.2 Optical implementation of unitary operation Vg^ . HWP - half-wave plate, PBS - 
polarizing beam splitter. 
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